Home page logo

pen-test logo Penetration Testing mailing list archives

[PEN-TEST] Hard-coded passwords in WINNT directory?
From: Jonathan Wrathall <JWrathall () JAWZINC COM>
Date: Mon, 27 Nov 2000 15:23:42 -0700

During a test of a client's IIS web server, I've encountered the following

1.  I am able to view files in the WINNT directory using the "MS Index
Server '%20' ASP Source Disclosure Vulnerability" vulnerability.

2. I am able to connect to IPC$, and I've used dumpsec to get the userlist

3. The winnt/system32/repair/sam._ file does not appear to be present.

Can anyone suggest other files that might reveal hard-coded passwords, or
other valuable information?

Jonathan Wrathall, BCom
Security Consultant

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]